feat(subprocess): migrate lsp-local, subagent-acp, and the env scrubs onto the seam

Review direction (tianyicui, PR #660): in a stacked PR, change all other
process-running places to use the new service.

- lsp-local: LspConnection spawns through ctx.subprocess (piped protocol
  streams + a no-spill collected stderr tail); its private process-tree
  helpers (POSIX group signalling, Windows taskkill, liveness polling) are
  deleted in favor of the seam's handle verbs, and its buildChildEnv now
  rides scrubbedParentEnv (LSP children also stop inheriting stale DSH_*).
  The plugin injects 'subprocess'; compositions/tests mount
  dsh-subprocess-local.
- subagent-acp: the ACP child spawns through the seam (piped ndjson streams,
  inherited stderr); spawn failure surfaces through done-rejection into the
  same startup race; disposal is handle.dispose with the plugin's configured
  graces. dsh-subagent-subprocess is DELETED — its dispose ladder and scrub
  are the seam's, and the isolated-config-dir helper had no consumer.
- mcp-client, pty-local, sdk-helper: adopt scrubbedParentEnv as the one
  scrub definition (their spawns stay put by ownership: the MCP SDK and
  node-pty own those calls; the SDK wizard runs outside any composition).
- Coverage: per-file 100% over every touched src file, with each v8 ignore
  carrying a platform or contract reason; new suites cover stdio
  dispositions, the dispose ladder tiers, injected-win32 tree semantics,
  waitForExit, settled-kill/terminate no-ops, and spawn-failure disposal.
- Docs: consumer-migration Agent Note (en; zh follows in this PR), seam note
  updated in place, subprocess.md rewritten for the reshaped vocabulary
  (type-equiv re-registered), READMEs and SERVICE_ROLES updated, taskkill
  added to knip ignoreBinaries.

packages/subprocess/subprocess-local/src/spawn.ts

@@ -258,8 +258,9 @@ export function killGroup(pid: number, sig: NodeJS.Signals): void {
  */
 export function taskkillProcessTree(pid: number): void {
   if (pid <= 0) return
-  // Outcome deliberately unchecked: an already-absent tree (status 128) and
-  // exit races are as tolerable here as ESRCH is for a POSIX group signal.
+  // Outcome deliberately unchecked: an already-absent tree (status 128), exit
+  // races, and a missing taskkill binary (spawnSync reports, never throws) are
+  // as tolerable here as ESRCH is for a POSIX group signal.
   spawnSync('taskkill', ['/PID', String(pid), '/T', '/F'], { stdio: 'ignore' })
 }
 
@@ -284,11 +285,14 @@ function signalTree(
   try {
     process.kill(-pid, sig)
   } catch {
+    /* v8 ignore start -- the fallback needs a live child whose group signal fails
+       (EPERM-style), which POSIX CI cannot stage; the swallow keeps teardown idempotent. */
     try {
       child.kill(sig)
     } catch {
       // The direct child already exited; teardown remains idempotent.
     }
+    /* v8 ignore stop */
   }
 }
 
@@ -360,6 +364,7 @@ export function spawnSubprocess(spec: SubprocessSpawnSpec, internals: SpawnInter
     if (settled) return
     signalTree(platform, pid, 'SIGTERM', child, taskkill)
     graceTimer = setTimeout(() => {
+      /* v8 ignore next -- the timer is cleared at settlement; only an in-flight fire racing the close event sees settled=true. */
       if (!settled) signalTree(platform, pid, 'SIGKILL', child, taskkill)
     }, spec.graceMs)
   }
@@ -422,6 +427,8 @@ export function spawnSubprocess(spec: SubprocessSpawnSpec, internals: SpawnInter
       return true
     } catch (error) {
       const code = (error as NodeJS.ErrnoException).code
+      /* v8 ignore next -- POSIX reports an absent group as ESRCH; child-reaping timing
+         makes observing the other arm platform-dependent. */
       if (code === 'ESRCH') return false
       /* v8 ignore start -- EPERM and non-POSIX negative-pid failures are platform defenses; CI runs
          tree-lifecycle tests on POSIX hosts where absence reports ESRCH. */
@@ -442,7 +449,8 @@ export function spawnSubprocess(spec: SubprocessSpawnSpec, internals: SpawnInter
   /** Race settlement against a timer without leaving listeners or live timers behind. */
   const settlesWithin = async (ms: number): Promise<boolean> => {
     if (settled) return true
-    let timer: NodeJS.Timeout | undefined
+    // The executor runs synchronously, so the timer is assigned before the race.
+    let timer!: NodeJS.Timeout
     const timeout = new Promise<false>((resolve) => {
       // `.unref()` so a pending grace timer never keeps the parent's loop alive.
       timer = setTimeout(() => { resolve(false) }, ms)
@@ -451,7 +459,7 @@ export function spawnSubprocess(spec: SubprocessSpawnSpec, internals: SpawnInter
     try {
       return await Promise.race([done.then(() => true, () => true), timeout])
     } finally {
-      if (timer !== undefined) clearTimeout(timer)
+      clearTimeout(timer)
     }
   }
 
@@ -474,9 +482,11 @@ export function spawnSubprocess(spec: SubprocessSpawnSpec, internals: SpawnInter
 
   return {
     pid,
+    /* v8 ignore start -- pipe-mode fds exist on every spawn Node returns; the null-coalesces guard a nonconforming ChildProcess only. */
     stdin: stdinMode === 'pipe' ? child.stdin ?? undefined : undefined,
     stdout: outMode === 'pipe' ? child.stdout ?? undefined : undefined,
     stderr: errMode === 'pipe' ? child.stderr ?? undefined : undefined,
+    /* v8 ignore stop */
     collected: {
       ...stdoutCollector !== undefined ? { stdout: stdoutCollector } : {},
       ...stderrCollector !== undefined ? { stderr: stderrCollector } : {},